CVE-2025-9176

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-9176

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9176.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-9176

Published

2025-08-20T00:15:25.557Z

Modified

2026-04-10T05:37:44.774901Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Handler. The manipulation results in os command injection. The attack is only possible with local access. The exploit has been released to the public and may be exploited.

References

Affected packages

Git / github.com/neurobin/shc

Affected ranges

Type

GIT

Repo

https://github.com/neurobin/shc

Events

Introduced

Last affected

7e5b6be461fb29a2e9ada116b00eadcc4d5b9b1b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.3"
        }
    ]
}

Affected versions

3.*

3.9.1

3.9.3a4

3.9.4

3.9.6

3.9.8

4.*

4.0.0

4.0.1

4.0.2

4.0.3

shc-3.*

shc-3.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9176.json"